Skip to content

Infinite Loop in UDF Injection #5895

@MachiavelliII

Description

@MachiavelliII

Describe the bug
When executing the sqlmap command with the --udf-inject option targeting a PostgreSQL database, the tool enters an infinite loop prompting for the UDF name. This occurs despite providing a shared library (--shared-lib=udf.so) and other necessary parameters, rendering the UDF injection feature unusable.

To Reproduce

  1. Run 'sqlmap -r req --dbms=postgres --threads 10 --ignore-code 401 --udf-inject --shared-lib=udf.so --batch' or only add --udf-inject
  2. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
https://asciinema.org/a/L4zFiQEHSnNZiKAm0h1HlQRWY

Running environment:

  • sqlmap version 1.9.2#pip and 1.9.5#pip
  • Installation method [e.g. pip]
  • Operating system: [e.g. Microsoft Windows 11]
  • Python version [e.g. 3.11.2]

Target details:

  • DBMS [e.g. postgreSQL]
  • SQLi techniques found by sqlmap [e.g. error-based and boolean-based blind]
  • WAF/IPS [if any]
  • Relevant console output [if any]
  • Exception traceback [if any]

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions